aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-09-28Added -PassThru to Invoke-TokenManipulationclymb3r1-5/+35
Thanks to Run Mariboe for the contribution to Invoke-TokenManipulation adding the -PassThru flag for newly created processes. Version increased to 1.11.
2014-07-10Bug fixes to Invoke-ReflectivePEInjectionclymb3r1-63/+157
Fixed a bug where calling GetProcAddress by ordinal instead of procedure name failed. Fixed a bug where reflectively loading an EXE will cause the entry function (main()) to be called twice instead of once as expected. Added a ForceASLR flag to force ASLR to be used even if the PE file doesn't officially support ASLR. Some minor other changes.
2014-05-20Update to latest Mimikatz (crash fix on Win7/8)clymb3r1-4/+4
The latest version of Mimikatz fixes a crash that happens on Windows7/8 (and server versions) after installing the latest Windows updates.
2014-05-04Updated to latest Mimikatzclymb3r1-10/+24
Latest version of Mimikatz now natively supports being reflectively loaded by Invoke-ReflectivePEInjection, updating the script to take advantage of this new version.
2014-04-28Fixing error in scriptclymb3r1-2/+0
2014-04-16Fixing formattingclymb3r2-1/+2
2014-04-16Fixing garbage put in by mergeclymb3r2-17/+0
2014-04-16Merge branch 'master' of https://github.com/mattifestation/PowerSploitclymb3r364-17271/+1688
Conflicts: Recon/Get-ComputerDetails.ps1 Recon/Recon.psd1
2014-04-16Updating Invoke-Mimikatz to Mimikatz 2.0 alphaclymb3r1-9/+9
2014-03-21Missing File NamesChris Campbell1-2/+2
Added printers.xml and drives.xml to the search.
2014-03-16Fixed error in PowerSploit ADS removal one-linermattifestation1-1/+1
2014-03-16Adding internal recon/privesc privesc functions #40mattifestation2-1/+583
Added the following recon functions written by Joe Bialek (@JosephBialek): - Find-4648Logons - Find-4624Logons - Find-AppLockerLogs - Find-PSScriptsInPSAppLog - Find-RDPClientConnections - Get-ComputerDetails (Combines all of the above functions into a single function)
2014-03-05Bug fix of from v3 XML expanding to $CountChris Campbell1-2/+2
This bug fix was from @jakxx
2014-03-05Update to version 2.4.0 from @jakxxChris Campbell1-3/+14
Removed unnecessary comment, merged update with printers.xml and drives.xml from @jackxx
2014-03-02Separating out functions & bug fixclymb3r1-295/+438
All info gathering pieces of this script can now be called individually. Fixed a bug where the user SID wasn't being converted to a username in the RDP function.
2014-03-01Added Get-VolumeShadowCopy and Mount-VolumeShadowCopymattifestation3-1/+157
2014-02-23Consolidated Persistence module functions into Persistence.psm1mattifestation5-703/+701
It doesn't make sense to have these as separate ps1 files.
2014-02-23#31 Persistence module function nouns are now singularmattifestation5-42/+42
The function names New-UserPersistenceOption and New-ElevatedPersistenceOptionNew-ElevatedPersistenceOption now conform to PowerShell naming best practices.
2014-02-21Merge pull request #32 from obscuresec/masterMatt Graeber1-72/+65
Minor fixes for compatibility between versions
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-3/+3
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-1/+1
2014-02-21Changed the direction of XML parsingChris Campbell1-70/+63
Used Select-XML to ensure compatibility with v2
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-1/+1
Iterate version.
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-5/+5
2014-02-21Update Get-GPPPassword.ps1Chris Campbell1-12/+12
Bug fix of variables.
2014-02-21Major Revision of Get-GPPPasswordsmattifestation1-59/+141
Thanks @obscuresec!
2014-02-20Adding Get-ComputerDetails recon scriptclymb3r2-1/+439
Get-ComputerDetails is a recon script which pulls a variety of useful information off a computer which might later be useful by an attacker. This includes: Logons AppLocker process start logs PowerShell logs to find scripts run RDP Client saved servers
2014-02-12Changed Inject-LogonCredentials name to Invoke-CredentialInjectionmattifestation1-1/+1
2014-02-12Merge pull request #28 from clymb3r/masterMatt Graeber5-3423/+3432
Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.
2014-02-12Inject-LogonCredentials has been renamed to Invoke-CredentialInjection.clymb3r5-3423/+3432
Added a check to ensure the script isn't being run from Session0 with the "NewWinLogon" flag. This flag does not work in Session0 because winlogon.exe tries to load stuff from user32.dll which requires a desktop is present. This is not possible in Session0 because there is no desktop/GUI, so it causes winlogon to load and then immediately close with error code c0000142 indicating a DLL failed to initialize. There is no way to fix this that I know of, if you need to run the script from Session0 use the "ExistingWinLogon" flag.
2014-02-03Add Get-Entropymattifestation3-1/+111
2014-02-03Removed mimikatz.mattifestation289-16310/+0
This doesn't need to reside in PowerSploit. Those that are truly paranoid should validate that the embedded executable in Invoke-Mimikatz.ps1 is indeed mimikatz. This was causing AV to flag upon downloading PowerSploit.
2014-01-30Merge pull request #26 from obscuresec/masterMatt Graeber1-105/+130
Update Invoke-ReverseDnsLookup.ps1
2014-01-30Update Invoke-ReverseDnsLookup.ps1Chris Campbell1-105/+130
Added pipeline support and verbose statement.
2014-01-25Generate a non-terminating error if there's a binding/framework version mismatchmattifestation2-0/+5
The user should at least be made aware if they're using an unsupported framework library version.
2014-01-25Upgraded Capstone framework libs to 2.0mattifestation2-0/+0
These are the compiled libs straight from http://www.capstone-engine.org/download.html
2014-01-25Disable non-standard cmdlet verb checkingmattifestation1-1/+1
2014-01-19Capstone.dll returns the correct number of operands now.mattifestation1-0/+0
2014-01-19Capstone module now incorporates framework 2.0RC1mattifestation10-127/+176
* I also moved the contents of Get-CSDisassembly.ps1 into Capstone.psm1
2014-01-11Merge pull request #25 from clymb3r/masterMatt Graeber1-32/+142
Bug fixes for Invoke-TokenManipulation
2014-01-10Bug fixes for Invoke-TokenManipulationclymb3r1-32/+142
Processes could not be started when the script was being run from Session 0. The fix is to use the CreateProcessAsUserW function when running in Session 0. This API requires SeAssignPrimaryTokenPrivilege priviege, so for non-session0 calls I still use CreateProcessWithTokenW which does not require special privileges.
2014-01-04Updated usage documentationmattifestation1-2/+3
2014-01-04Updated C# Capstone binding to latest versionmattifestation1-0/+0
2014-01-01Fixes #23 - $Password was not being clearedmattifestation1-0/+1
2013-12-26Adding 64-bit lib filemattifestation2-1/+0
2013-12-26Major update to Capstone disassembly modulemattifestation4-16/+13
* Refactor of C# capstone binding * Now compatible in 32 and 64-bit PowerShell
2013-12-22Added Capstone Engine PowerShell bindingmattifestation10-0/+266
Consider this to be an alpha release until the C# binding is published.
2013-11-18Added Inject-LogonCredentials to READMEmattifestation1-0/+4
2013-11-18Merge pull request #21 from clymb3r/masterMatt Graeber18-1/+4428
Adding Inject-LogonCredentials
2013-11-17Adding Inject-LogonCredentialsclymb3r18-1/+4428
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-29 02:40:06 +0000